fix-react2shell-next

Why it's ranked here

This is a focused remediation tool with unusually practical monorepo and automation support. Its strongest design choice is combining overlapping advisories into one minimum safe upgrade. The narrow version parser and inconsistent library packaging keep it from serving as a general dependency security system.

What's good

Dry-run and JSON modes support audits and scripting without modifying projects. Interactive confirmation protects local use, while automatic fixing suits CI. It understands npm, Yarn, pnpm, and Bun, checks installed versions for ranges or unusual specifications, and tests the logic that selects patches across multiple advisories.

Tradeoffs

The scanner only knows vulnerabilities encoded in its registry, so it cannot replace broad dependency auditing. Version parsing handles stable, release candidate, and canary forms, but not arbitrary semantic-version syntax. If an unusual specification cannot be resolved from the installed dependency, the tool reports an unknown case and recommends a fixed fallback.

How to use it well

Use it when maintaining Next.js or React Server Components projects, especially monorepos needing a repeatable emergency patch workflow. Start with dry-run or JSON output, inspect the proposed exact pins, apply fixes, then test and commit. Keep a general vulnerability scanner alongside it for unrelated packages and advisories.

Observed

License

MIT

Primary language

JavaScript using CommonJS modules

Install surface

Published npm package runnable through npx

Interface

Command-line interface with interactive, automatic fix, dry-run, JSON, and lockfile-only modes

Runtime

Node.js 16 or newer

Package managers

Supports npm, Yarn, pnpm, and Bun

Repository structure

Includes dedicated vulnerability modules, utility modules, and Node test files